Two-minute brief
NIST CSF 2.0 explained: video brief
A two-minute brief on the structure of the NIST Cybersecurity Framework 2.0 and how its outcomes become a programme through Profiles and Tiers.
Key takeaways
- The CSF describes outcomes; it does not prescribe how to achieve them.
- Six Functions: Govern, Identify, Protect, Detect, Respond and Recover.
- Govern, new in 2.0, covers strategy, policy, oversight and supply chain risk.
- Profiles record current and target outcomes; Tiers describe rigour.
- No NIST certification exists for the framework.
Outcomes, not mandatory controls
NIST CSF 2.0 contains outcomes, not requirements, and NIST states that it does not prescribe how they are achieved. You decide which outcomes matter for your risks and obligations, record them in a Target Profile and choose the controls that deliver them, with the Informative References pointing at the standards you already use. This short film lays out how the framework is structured.
The Core is organised into six Functions, 22 Categories and 106 Subcategories. Govern covers the organisation's cybersecurity risk management strategy, expectations and policy: organizational context, risk management strategy, roles, responsibilities and authorities, policy, oversight and cybersecurity supply chain risk management. In practice that means a strategy and risk appetite approved by leadership, a policy people have read, named accountabilities, supplier security requirements in contracts and cybersecurity as a standing item at board level. Identify is about understanding the organisation's current cybersecurity risks.
Profiles and Tiers turn the Core into a programme
Protect, Detect, Respond and Recover complete the Core: safeguards to manage cybersecurity risk, finding and analysing possible attacks and compromises, taking action on detected incidents, and restoring assets and operations affected by an incident. Organizational Profiles record the outcomes you achieve today and the ones you have chosen to reach, and Tiers characterise how rigorously cybersecurity risk is governed and managed.
NIST designed the framework for organisations of all sizes and sectors, regardless of maturity. CSF 2.0 was published on 26 February 2024, replacing version 1.1 of April 2018. It is voluntary, has no transition deadline and carries no certification; whether a Target Profile is achieved is judged by your leadership, internal audit and, if you choose, an independent assessor.
Organisations usually reach for the framework when leadership wants a cybersecurity picture it can understand and steer, when a customer or a US federal contract asks whether they are aligned with NIST, or when several existing control sets need one common language for reporting.
NIST CSF 2.0 at a glance
- Purpose
- Cybersecurity risk management: a taxonomy of outcomes across six Functions, Govern, Identify, Protect, Detect, Respond and Recover, for understanding, prioritising and communicating cyber risk
- Relevant to
- Organisations of any size, sector or maturity; boards and executives, security and IT leaders, risk managers, US federal suppliers and anyone asked "are you aligned with NIST?"
- Edition
- CSF 2.0 (NIST CSWP 29), published 26 February 2024, replacing version 1.1 of April 2018; no transition deadline, because the framework is voluntary
- Certification
- None. NIST publishes the framework and does not certify against it; no "NIST certified" status exists. Your Profile is assessed by your own leadership, internal audit and, if you choose, an independent assessor
- Sterling's role
- Profile design with your leadership, the priority outcomes implemented with your teams, Effivity, training and the first review cycle, then Sustain™
- Cost and timing
- Total investment for a NIST CSF 2.0 programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 9 months
NIST CSF 2.0: questions people ask
Can an organisation be certified to NIST CSF 2.0?
No. NIST publishes the framework and does not certify anyone against it; its own FAQ states that it has no plans to develop a conformity assessment programme and leaves conformity needs to the private sector. A provider offering a "NIST certified" badge or a "CSF compliance certificate" is offering a document of its own design, and Sterling does not issue one either. What an organisation can have is a Target Profile, evidence that its outcomes are achieved and, if it wants one, an independent assessment of both.
Is NIST CSF 2.0 mandatory?
Not for most organisations. NIST describes the CSF as guidance that may be adopted voluntarily and through government policies and mandates: US federal agencies have been required to apply it since a 2017 Executive Order, and some regulators, insurers and customers reference it in their requirements. Otherwise you adopt it because you want a structured, widely recognised way to manage cybersecurity risk.
What changed between CSF 1.1 and CSF 2.0?
Version 2.0, published on 26 February 2024, is the first major update since the framework's creation in 2014. It addresses all organisations rather than critical infrastructure alone, adds Govern as a sixth Function, brings cybersecurity supply chain risk management into the Core, reorganises the Categories and Subcategories, and comes with Quick Start Guides, a Reference Tool, an Organizational Profile template and Community Profiles.
How does NIST CSF 2.0 relate to ISO/IEC 27001?
They do different jobs and work well together. ISO/IEC 27001 is a requirements standard for an information security management system, certifiable by an accredited body; the CSF is a voluntary set of outcomes with no certification. NIST's Informative Reference catalogue lists a mapping between ISO/IEC 27001:2022 and CSF 2.0, so an ISMS can supply most of the controls behind a Target Profile while the CSF gives leadership, customers and insurers the outcome view: the certificate for the market, the Profile for the board.
What is the difference between the CSF and NIST SP 800-53 or SP 800-171?
The CSF says what outcomes to achieve; SP 800-53 and SP 800-171 say which controls to implement. SP 800-53 is NIST's catalogue of security and privacy controls, in twenty control families; SP 800-171 sets the requirements for protecting controlled unclassified information in non-federal systems, reaching suppliers through US federal contracts. Both are Informative References for CSF 2.0, so coverage of either can be shown in the Profile.
Keep exploring
Related to this video
The complete guide
Everything on NIST CSF 2.0
Start with the NIST CSF 2.0 page, or go straight to the guide you need.
On the NIST CSF 2.0 page
- What does NIST CSF 2.0 ask of an organisation?
- How do you implement NIST CSF 2.0?
- How much does NIST CSF 2.0 implementation cost?
- How long does NIST CSF 2.0 implementation take?
- Who needs NIST CSF 2.0 implementation?
- How NIST CSF 2.0 improves cybersecurity decisions and protects the business
- Frequently asked questions about NIST CSF 2.0
Guides
Often combined with NIST CSF 2.0
More videos: Information security, cyber and cloud
- How to implement NIST SP 800-171Implementation walkthrough · 3 min 15 s
- NIST SP 800-171 requirements explainedTwo-minute brief · 2 min
- How to get TISAX labelsImplementation walkthrough · 3 min 15 s
- TISAX requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE IA StandardCompliance walkthrough · 3 min 15 s
- UAE IA Standard requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27001Implementation walkthrough · 3 min 24 s
- ISO/IEC 27001 requirements explainedTwo-minute brief · 2 min
- How to implement PCI DSSImplementation walkthrough · 3 min 24 s
Talk to a consultant
Plan your NIST CSF 2.0 implementation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice